CVE-2018-14704

Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a malformed URL path...

CVE-2018-14695

Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve diagnostic information via the "name" URL parameter...

CVE-2018-14695

The CVE-2018-14695 entry concerns Drobo 5N2 NAS (version 4.0.5-13.28.96115). The issue is an improper access control in the /mysql/api/diags.php endpoint that allows unauthenticated users to retrieve diagnostic information via the name parameter. Public references note impact as exposure of diagn...

CVE-2018-14699

System command injection in the /DroboAccess/enableuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter...

CVE-2018-14696

Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information...

CVE-2018-14703

CVE-2018-14703 affects Drobo 5N2 NAS (version 4.0.5-13.28.96115). The issue is improper access control on the /mysql/api/droboapp/data endpoint, enabling unauthenticated attackers to retrieve the MySQL root password. The NVD entry notes a high-impact condition (CVE-3.0 vector: network, no auth, h...

CVE-2018-14701

System command injection in the /DroboAccess/deleteuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter...

CVE-2018-14700

CVE-2018-14700 affects Drobo 5N2 NAS (version 4.0.5-13.28.96115) via the /mysql/api/logfile.php endpoint. The vulnerability arises from incorrect access control, enabling unauthenticated attackers to retrieve MySQL log files by supplying a name parameter. This exposes partial confidentiality (log...

CVE-2018-14706

The vulnerability CVE-2018-14706 affects Drobo 5N2 NAS with DroboPix, endpoint /DroboPix/api/drobopix/demo, on version 4.0.5-13.28.96115. It is a system command injection via a crafted POST payload to that endpoint, allowing an unauthenticated attacker to execute arbitrary commands on the device ...

CVE-2018-14704

CVE-2018-14704 affects Drobo 5N2 NAS (firmware around 4.0.5-13.28.96115) with a cross-site scripting vulnerability in the MySQL API error page. The issue arises from unsanitized data in the error page, allowing a remote attacker to execute JavaScript via a malformed URL path. Public references (N...

CVE-2018-14701

CVE-2018-14701 affects Drobo 5N2 NAS (version 4.0.5-13.28.96115) via the /DroboAccess/delete_user endpoint. It allows unauthenticated attackers to inject and execute system commands through the username parameter, with reported impact of potential full command execution on the device. Public expl...